agentsclimarketplace

Analyzing api call traces

Skill meltedinhex/analyst-ai-pack/skills/analyzing-api-call-traces

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-api-call-traces

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, as published. Nobody here has run it

Analyzing API Call Traces

When to Use

  • You have a JSON API trace (CAPE/Cuckoo "apistats"/calls, API Monitor export) from a detonation.
  • You need to translate raw API calls into high-level behaviors and flag suspicious sequences (e.g., VirtualAllocEx → WriteProcessMemory → CreateRemoteThread).

Do not use this as a substitute for detonation — it consumes an existing trace produced in an isolated sandbox.

Prerequisites

  • A JSON API trace with at least an API name per call (and optionally arguments).

Safety & Handling

  • Consume traces only; never execute the sample to generate one outside a sandbox.

Workflow

Step 1: Group calls by category

python scripts/analyst.py classify trace.json

Buckets calls into process, memory, file, registry, network, crypto, and synchronization.

Step 2: Detect behavior signatures

Matches ordered API sequences that indicate techniques — remote injection, hollowing, self-deletion, dynamic API resolution (LoadLibrary/GetProcAddress bursts).

Step 3: Prioritize and report

Rank detected behaviors by severity and map each to ATT&CK.

Validation

  • Each API call is categorized; unknown APIs are reported, not dropped silently.
  • Injection-style sequences are detected only when the ordered prerequisites are present.
  • Detected behaviors map to ATT&CK techniques.

Pitfalls

  • Flagging individual benign APIs out of context — the sequence matters.
  • Assuming call order in the JSON equals execution order without a timestamp/index.
  • Ignoring failed calls (non-zero error) that never actually executed the behavior.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.